Add recovered protocol stack, Wi-Fi hotspot join, and RE findings

Reconstruct the app's Dart-layer behaviour (blutter over libapp.so,
jadx over base.apk — see docs/RE_DART_FINDINGS.md) as working Python,
replacing the library stubs with a real local-connect stack.

protocol/ (new package, hardware-independent):
- commands: CommunicationMode / CommunicationOperate / CommunicationCmd
  enums with the raw values recovered from the Dart object pool
- envelope: CommunicationObject with the app's exact JSON key order
- crypto: SN-derived secret key and the position-dependent additive
  cipher (encrypt/decrypt; radix 16 default, 32 documented alternate)
- crc: CRC-16/MODBUS with the app's hi/lo swap + 4-hex string form,
  CRC32 envelope check, little-endian int16 helpers
- framing: BLE frame build/parse (0x5AA5 data / 0x4AA4 ACK magics,
  CRC slots, MTU chunking) and local-socket int16LE length framing
  plus a streaming SocketFrameDecoder

wifi.py (rewritten):
- derive_hotspot_credentials(): the AP_<sn> SSID/password rules
  (20-char SN branch, full-SN fallback with the app's warning log)
- WifiBackend abstraction: NmcliWifiBackend for Linux hosts via
  nmcli, NoOpWifiBackend for radio-less containers
- WifiManager keeps the original stub method names for API compat
  and adds join_device_hotspot(sn) / leave_device_hotspot() / local_ip()

device_local.py (new): LocalDeviceClient for the mode==local path —
the /terminal/* HTTP endpoint family (hotspot info, aGate info,
overall info, MQTT relay, ...) and direct-connect socket RPC
(envelope -> cipher -> length frame -> decrypt -> JSON) with
convenience query_* RPCs.

docs/RE_DART_FINDINGS.md (new): the full findings — transport
selector, wire envelope, crypto, CRCs, MQTT (AWS IoT + Cognito),
socket, BLE + ESP provisioning, hotspot credential derivation,
local/cloud HTTP layers, and the Java glue — plus the open items;
README now links to it.

Unconfirmed candidates (local port 18000, cipher key radix, BLE
field order, X-Device-* header values) are flagged in the docs and
kept configurable in code.

franklinwh_agate_client/protocol/commands.py

@@ -0,0 +1,86 @@
+"""Transport selector, operation codes and command ids.
+
+Recovered from the object pool (``pp.txt``) of ``libapp.so`` — see
+``docs/RE_DART_FINDINGS.md`` §2, §4.
+"""
+
+from __future__ import annotations
+
+from enum import IntEnum
+
+
+class CommunicationMode(IntEnum):
+    """Transport selector (raw values as in the Dart enum)."""
+
+    MQTT = 0
+    SOCKET = 1
+    BLUETOOTH = 2
+    HTTP = 3
+    LOCAL = 4
+
+
+class CommunicationOperate(IntEnum):
+    """``type`` field of the wire envelope."""
+
+    QUERY = 0
+    SET = 1
+    COMMAND = 2
+    MODIFY = 5
+
+
+class CommunicationCmd(IntEnum):
+    """``cmdType`` field of the wire envelope.
+
+    Gaps 0x09, 0x1B, 0x2C, 0x31 are not surfaced as instances in the pool.
+    ``WIFI_FREQUECY`` keeps the app's spelling.
+    """
+
+    QUERY_DEVICE_INFO = 0x00
+    NETWORK_INFO = 0x01
+    RESOURCE_ADDRESS = 0x02
+    SUNSPEC_MODBUS = 0x03
+    NETWORK_SWITCH = 0x04
+    FEEDING_GRID_POWER = 0x05
+    MODE = 0x06
+    MODE_V2 = 0x07
+    MODE_SETTING_V2 = 0x08
+    SOLAR_INFO = 0x0A
+    ENERGY_MANAGE_INFO = 0x0B
+    GENERATOR_INFO = 0x0C
+    BLUETOOTH_HEARTBEAT = 0x0D
+    SCAN_WIFI_LIST = 0x0E
+    CONNECT_WIFI = 0x0F
+    CONNECTION_STATUS = 0x10
+    NETWORK_CHANNEL_STATUS = 0x11
+    NETWORK_CHANNEL = 0x12
+    PAIR_POWER = 0x13
+    PROCESS_PAIR_POWER = 0x14
+    CHECK_BLUETOOTH_PASSWORD = 0x15
+    GO_OFF_GRID_STATUS = 0x16
+    A_POWER_LED_SWITCH = 0x17
+    DEVICE_DETAIL_INFO = 0x18
+    DEVICE_APOWER_INFO = 0x19
+    DEVICE_ALARMS = 0x1A
+    PE = 0x1C
+    BMS = 0x1D
+    EMS = 0x1E
+    MPPT = 0x1F
+    A_HUB = 0x20
+    CT_TEST_REVERSE = 0x21
+    DEVICE_DATA = 0x22
+    LOAD_STATUS = 0x23
+    LOAD_STATUS_2 = 0x24
+    SMART_LOAD = 0x25
+    SMART_LOAD_2 = 0x26
+    REBOOT_DEVICE = 0x27
+    DEBUG_MODE = 0x28
+    POWER_ON = 0x29
+    CHARGE_DEVICE = 0x2A
+    CLEAR_FAULT = 0x2B
+    DEVICE_ADDRESS_INFO = 0x2D
+    OVERLOAD_CUT_OFF = 0x2E
+    WIFI_FREQUECY = 0x2F  # sic
+    BREAKER_COMMISSION_NOTIFY = 0x30
+    BREAKER_COM_STATE = 0x32
+    BREAKER_LOAD_STATUS = 0x33
+    BREAKER_IDENTIFY_ME = 0x34